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Abstract 

As partial justification of their framework for iterated belief revision Darwiche and 
Pearl convincingly argued against Boutilier's natural revision and provided a prototypical 
revision operator that fits into their scheme. We show that the Darwiche-Pearl arguments 
lead naturally to the acceptance of a smaller class of operators which we refer to as ad- 
missible. Admissible revision ensures that the penultimate input is not ignored completely, 
thereby eliminating natural revision, but includes the Darwiche-Pearl operator, Nayak's 
lexicographic revision operator, and a newly introduced operator called restrained revision. 
We demonstrate that restrained revision is the most conservative of admissible revision 
operators, effecting as few changes as possible, while lexicographic revision is the least con- 
servative, and point out that restrained revision can also be viewed as a composite operator, 
consisting of natural revision preceded by an application of a "backwards revision" oper- 
ator previously studied by Papini. Finally, we propose the establishment of a principled 
approach for choosing an appropriate revision operator in different contexts and discuss 
future work. 
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1. Introduction 

The ability to rationally change one's knowledge base in the face of new information which 
possibly contradicts the currently held beliefs is a basic characteristic of intelligent be- 
haviour. Thus the question of belief revision is of crucial importance in Artificial Intelligence. 
In the last twenty years this question has received considerable attention, starting from the 
work of Alchourron, Gardenfors, and Makinson (1985) - usually abbreviated to just AGM- 
who proposed a set of rationality postulates which any reasonable revision operator should 
satisfy. A semantic construction of revision operators was later provided by Katsuno and 
Mendelzon (1991), according to which an agent has in its mind a plausibility ordering - a 
total preorder - over the set of possible worlds, with the knowledge base associated to this 
ordering being identified with the set of sentences true in all the most plausible worlds. This 
approach dates back to the work of Lewis (1973) on counterfactuals. It was introduced into 
the belief revision literature by Grove (1988) and Spohn (1988). Given a new sentence - or 
epistemic input - a, the revised knowledge base is set as the set of sentences true in all the 
most plausible worlds in which a holds. As was shown by Katsuno and Mendelzon (1991), 
the family of operators defined by this construction coincides exactly with the family of op- 
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erators satisfying the AGM postulates. Due to its intuitive appeal, this construction came 
to be widely used in the area. However, researchers soon began to notice a deficiency with 
it - although it prescribes how to obtain a new knowledge base, it remains silent on how to 
obtain a new plausibility ordering which can then serve as a target for the next epistemic 
input. Thus it is not rich enough to deal adequately with the problem of iterated belief 
revision. This paper is a contribution to the study of this problem. 

Most iterated revision schemes are sensitive to the history of belief changes 1 , based on 
a version of the "most recent is best" argument, where the newest information is of higher 
priority than anything else in the knowledge base. Arguably the most extreme case of this is 
Nayak's lexicographic revision (Nayak, 1994; Nayak, Pagnucco, & Peppas, 2003). However, 
there are operators where, once admitted to the knowledge base, it rapidly becomes as 
much of a candidate for removal as anything else in the set when another, newer, piece of 
information comes along, Boutilier's natural revision (1993, 1996) being a case in point. 
A dual to this is what Rott (2003) terms radical revision where the new information is 
accepted with maximal, irremediable entrenchment - see also Segerberg (1998). Another 
issue to consider is the problem termed temporal incoherence (Rott, 2003): 

the comparative recency of information should translate systematically into com- 
parative importance, strength or entrenchment 

In an influential paper Darwiche and Pearl (1997) proposed a framework for iterated 
revision. Their proposal is characterised in terms of sets of syntactic and semantic postu- 
lates, but can also be viewed from the perspective of conditional beliefs. It is an extension 
of the formulation by Katsuno and Mendelzon (1991) of AGM revision (Alchourron et al., 
1985). To justify their proposal Darwiche and Pearl mount a comprehensive argument. The 
argument includes a critique of natural revision, which is shown to admit too few changes. 
In addition, they provide a concrete revision operator which is shown to satisfy their pos- 
tulates. In many ways this can be seen as the prototypical Darwiche-Pearl operator. It 
is instructive to observe that the two best-known operators satisfying the Darwiche-Pearl 
postulates, natural revision and lexicographic revision, form the opposite extremes of the 
Darwiche-Pearl framework: Natural revision is the most conservative Darwiche-Pearl oper- 
ator, in the sense that it effects as few changes as possible, while lexicographic revision is 
the least conservative. 

In this paper we show that the Darwiche-Pearl arguments lead naturally to the accep- 
tance of a smaller class of operators which we refer to as admissible. We provide char- 
acterisations of admissible revision, in terms of syntactic as well as semantic postulates. 
Admissible revision ensures that the penultimate input is not ignored completely. A conse- 
quence of this is that natural revision is eliminated. On the other hand, admissible revision 
includes the prototypical Darwiche-Pearl operator as well as lexicographic revision, the lat- 
ter result also showing that lexicographic revision is the least conservative of the admissible 
operators. The removal of natural revision from the scene leaves a gap which is filled by the 
introduction of a new operator we refer to as restrained revision. It is the most conservative 
of admissible revision operators, and can thus be seen as an appropriate replacement of 
natural revision. We give a syntactic and a semantic characterisation of restrained revision, 

1. An external revision scheme like that of Areces and Becher (2001) and Freund and Lehmann (1994) is 
not. 
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and demonstrate that it satisfies desirable properties. In particular, and unlike lexicographic 
revision, it ensures that older information is not discarded unnecessarily, and it shows that 
the problem of temporal incoherence can be dealt with. 

Although natural revision does not feature in the class of admissible revision operators, 
we show that it still has a role to play in iterated revision, provided it is first tempered 
appropriately. We show that restrained revision can also be viewed as a composite operator, 
consisting of natural revision preceded by an application of a "backwards revision" operator 
previously studied by Papini (2001). 

The paper is organised as follows. After outlining some notation, we review the Darwiche- 
Pearl framework in Section 2. This is followed by a discussion of admissible revision in 
Section 3. In Section 4 we introduce restrained revision, and in Section 5 we show how 
it can be defined as a composite operator. Section 6 discusses the possibility of enriching 
epistemic states as a way of determining the appropriate admissible revision operator in a 
particular context. In this section we also conclude and briefly discuss some future work. 

1.1 Notation 

We assume a finitely generated propositional language L which includes the constants T 
and _L, is closed under the usual propositional connectives, and is equipped with a classical 
model-theoretic semantics. V is the set of valuations of L and [a] (or [B]) is the set of 
models of a € L (or B C L). Classical entailment is denoted by 1= and logical equivalence 
by =. We also use Cn to denote the operation of closure under classical entailment. Greek 
letters a, (3,... stand for arbitrary sentences. In our examples we sometimes use the lower 
case letters p, q, and r as propositional atoms, and sequences of 0s and Is to denote the 
valuations of the language. For example, 01 denotes the valuation, in a language generated 
by p and q, in which p is assigned the value and q the value 1, while Oil denotes the 
valuation, in a language generated by p, q and r, in which p is assigned the value and 
both q and r the value 1. Whenever we use the term knowledge base we will always mean 
a set of sentences X which is deductively closed, i.e., X = Cn(X). 

2. Darwiche-Pearl Revision 

Darwiche and Pearl (1997) reformulated the AGM postulates (Alchourron et al., 1985) to 
be compatible with their suggested approach to iterated revision. This necessitated a move 
from knowledge bases to epistemic states. An epistemic state contains, in addition to a 
knowledge base, all the information needed for coherent reasoning including, in particular, 
the strategy for belief revision which the agent wishes to employ at a given time. Darwiche 
and Pearl consider epistemic states as abstract entities, and do not provide a single formal 
representation. It is thus possible to talk about two epistemic states E and F being identical 
(denoted by E = F) , but yet syntactically different. 2 This has to be borne in mind below, 
particularly when considering postulate (E * 5). In Darwiche and Pearl's reformulated 
postulates * is a belief change operator on epistemic states, not knowledge bases. We 
denote by B(E) the knowledge base extracted from an epistemic state E. 

(E*l) B(E * a) = Cn(B(E * a)) 
2. Personal communication with Adnan Darwiche. 
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(E*2) a € B(E*a) 

(E*3) B(E * a) C 5(E) + q 

(E*4) If £ 5(E) then 5(E) + a C 5(E * a) 

(E*5) If E = F and a = f3 then 5(E * a) = 5(F * /3) 

(E*6) _L € 5(E * a) iff N 

(E*7) 5(E * (a A (3)) C 5(E * a) + /3 

(E*8) If -v8 g 5(E * a) then 5(E * a) + (3 C 5(E * (a A /?)) 

Darwiche and Pearl then show, via a representation result similar to that of Katsuno and 
Mendelzon (1991), that revision on epistemic states can be represented in terms of plausi- 
bility orderings associated with epistemic states. 3 More specifically, every epistemic state 
E has associated with it a total preorder on all valuations, with elements lower down 
in the ordering deemed more plausible. Moreover, for any two epistemic states E and F 
which are identical (but may be syntactically different), it has to be the case that ^e=^f- 
Let min(a, ^e) denote the minimal models of a under ^e- The knowledge base associ- 
ated with the epistemic state is obtained by considering the minimal models in ^e i-e., 
[5(E)] = min(T, ^e)- Observe that this means that 5(E) has to be consistent. This 
requirement enables us to obtain a unique knowledge base from the total preorder ^e- 
Preservation of the results in this paper when this requirement is relaxed is possible, but 
technically messy. 

The observant reader will note that our assumption of a consistent 5(E) is incompatible 
with a successful revision by _L. This requires that we jettison (E*6) and insist on consistent 
epistemic inputs only. (The left-to-right direction of (E*6) is rendered superfluous by (E*l) 
and the assumption that knowledge bases extracted from all epistemic states have to be 
consistent.) The other difference between the original AGM postulates and the Darwiche- 
Pearl reformulation - first inspired by a critical observation by Freund and Lehmann (1994) 
- occurs in (E*5), which states that revising by logically equivalent sentences results in 
epistemic states with identical associated knowledge bases. This is a weakening of the 
original AGM postulate, phrased in our notation as follows: 

(5*5) If B(E) = B(¥) and a = f3 then B(E * a) = B(¥ * /3) 

(5*5) states that two epistemic states with identical associated knowledge bases will, after 
having been revised by equivalent inputs, produce two epistemic states with identical asso- 
ciated knowledge bases. This is stronger than (E*5) which requires equivalent associated 
knowledge bases only if the original epistemic states were identical. We shall refer to the 
reformulated AGM postulates, with (E*6) removed, as DP-AGM. 

DP-AGM guarantees a unique extracted knowledge base when revision by a is per- 
formed. It sets [B{E * a)] equal to min(a, ^e) and thereby fixes the most plausible valua- 
tions in ^e*«- However, it places no restriction on the rest of the ordering. The purpose 

3. Alternative frameworks for studying iterated revision, both based on using sequences of sentences rather 
than plausibility orderings, are those of Lehmann (1995) and Konieczny and Pino-Perez (2000). 
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of the Darwiche-Pearl framework is to constrain this remaining part of the new ordering. 
It is done by way of a set of postulates for iterated revision (Darwiche & Pearl, 1997). 
(Throughout the paper we follow the convention that * is left associative.) 

(CI) If /3 N a then B(E * a * (3) = B(E * (3) 

(C2) If t= then B(E * a * (3) = B(E * (3) 

(C3) If a G B(E * (3) then a G B(E * a * (3) 

(C4) If <£ B(E * (3) then <£ B(E * a * (3) 

The postulate (CI) states that when two pieces of information — one more specific than 
the other — arrive, the first is made redundant by the second. (C2) says that when two 
contradictory epistemic inputs arrive, the second one prevails; the second evidence alone 
yields the same knowledge base. (C3) says that a piece of evidence a should be retained 
after accommodating more recent evidence (3 that entails a given the current knowledge 
base. (C4) simply says that no epistemic input can act as its own defeater. We shall refer to 
the class of belief revision operators satisfying DP-AGM and (CI) to (C4) as DP-revision. 
The following are the corresponding semantic versions (with v,w G V"): 

(CR1) If v G [a], w G [a] then v w iff v ^e*q w 

(CR2) If v G [-ia],w G [~>a] then v w iff v ^e«* w 

(CR3) If v G [a] , w G [->a] then v -<e w only if v -<e*« w 

(CR4) If v G [a], w G [->a] then v ^e w only if v ^e*q w 

(CR1) states that the relative ordering between a-worlds remain unchanged following an a- 
revision, while (CR2) requires the same for -la-worlds. (CR3) requires that, for an a-world 
strictly more plausible than a -la-world, this relationship be retained after an a-revision, 
and (CR4) requires the same for weak plausibility. Darwiche and Pearl showed that, given 
DP-AGM, a precise correspondence obtains between (Ci) and (CRi) above (i = 1,2,3,4). 

One of the guiding principles of belief revision is the principle of minimal change: changes 
to a belief state ought to be kept to a minimum. What is not always clear is what ought to be 
minimised. In AGM theory the prevailing wisdom is that minimal change refers to the sets 
of sentences corresponding to knowledge bases. But there are other interpretations. With 
the move from knowledge bases to epistemic states, minimal change can be defined in terms 
of the fewest possible changes to the associated plausibility ordering ^e- In what follows we 
will frequently have the opportunity to refer to the latter interpretation of minimal change. 
See also the discussion of this principle by Rott (2000). 

3. Admissible Revision 

In this section we consider two of the best-known DP-operators, and propose three pos- 
tulates to be added to the Darwiche-Pearl framework. The first is more of a correction 
than a strengthening. We show that the Darwiche-Pearl representation of the principle of 
the irrelevance of syntax is too weak and suggest an appropriate strengthened postulate. 
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The second is suggested by some of the arguments advanced by Darwiche and Pearl them- 
selves. It eliminates one of the operators they criticise, and is satisfied by the sole operator 
they provide as an instance of their framework. The addition of these two postulates to 
the Darwiche-Pearl framework leads to the definition of the class of admissible revision 
operators. Finally, we point out a problem with Nayak's well-known lexicographic revision 
operator and propose a third postulate to be added. The consequences of insisting on the 
addition of this third postulate are discussed in detail in Section 4. 

As mentioned in Section 2, Darwiche and Pearl replaced the original AGM postulate 
(B * 5) with (E * 5). Both are attempts at an appropriate formulation of the principle 
of the irrelevance of syntax, popularised by Dalai (1988). But whereas (B * 5) has been 
shown to be too strong, as shown by Darwiche and Pearl (1997), closer inspection reveals 
that (E * 5) is too weak. To be more precise, it fails as an adequate formulation of syntax 
irrelevance for iterated revision. It specifies that revision by two equivalent sentences should 
produce epistemic states with identical associated knowledge bases, but does not require 
that these epistemic states, after another revision by two equivalent sentences, also have 
to produce epistemic states with identical associated knowledge bases. So, as can be seen 
from the following example, under DP-AGM (and indeed, even if (CI) to (C4) are added) 
it is possible for B{E * a* 7) to differ from B(E * (3 * 5) even if a is equivalent to (3 and 7 
is equivalent to 5. 

Example 1 Consider a propositional language generated by the two atoms p and q and let 
E be an epistemic state such that B(E) = Cn(pV q). Now consider the two epistemic states 
E' and E" such that B(E') = B(E") = Cn(p), 01 -< E > 00 and 00 01. Observe that 
this gives complete descriptions of and ^g" • It is tedious, but not difficult, to verify 
that setting ^e*p=^e' an d ^E*-.-.p=^E" is compatible with DP-AGM. But observe then that 
B(E *p* -ip) = Cn(-ip A q), while B(E * -i-<p * ^p) = Cn(^p A ^q). 

As a consequence of this, we propose that (E*5) be replaced by the following postulate: 
(E*5') If E = F, a = 13 and S = 7 then B(E * a * 7) = B(¥ * /3 * 5) 
The semantic equivalent of (E*5') looks like this: 
(Ei?*5') If E = F and a = (3 then ^ E * a =^¥*/3 

(Ei?*5 ; ) states that the revision of two identical epistemic states by two equivalent sen- 
tences has to result in epistemic states with identical associated total preorders, not just in 
epistemic states with identical associated knowledge bases. 

Proposition 1 (E* 5' ) and (ER*8 ' ) are equivalent, given DP-AGM. 

Proof: The proof that (E*5') follows from (ER*5') is straightfoward. For the converse, sup- 
pose that (ER*5') does not hold; i.e. a = (3 and ^F*a7^^E*/3 for some a and (3. This means 
there exist x, y € V such that x ^e*« U but y ^f*/3 x. Now let 7 be such that [7] = {x, y}. 
Then x G [B(E *a* 7)], but [B(¥ * /3 * 7)] = {y}, and so B(E * a * 7) / B(¥ * * 7); a 
violation of (E*5'). □ 
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From this it should already be clear that (E*5') is a desirable property. This view is bolstered 
further by observing that all the well-known iterated revision operators satisfy it; natural 
revision, the Darwiche-Pearl operator •, and Nayak's lexicographic revision, the first and 
third of which are to be discussed in detail below. In fact, we conjecture that Darwiche and 
Pearl's intention was to replace (B*5) with (E*5'), not with (E*5) and propose this as a 
permanent replacement. 

Definition 1 The set of postulates obtained by replacing (E*5) with (E*5') in DP-AGM is 
defined as RAGM. 

Observe that RAGM, like DP-AGM, guarantees that [B(E * a)] = min(a, ^ E ). 

Rule (E*5') is the first of the new postulates we want to add to the Darwiche-Pearl 
framework. We now lead up to the second. One of the oldest known DP-operators is 
natural revision, usually credited to Boutilier (1993, 1996), although the idea can also be 
found in (Spohn, 1988). Its main feature is the application of the principle of minimal 
change to epistemic states. It is characterised by DP-AGM plus the following postulate: 

(CB) If ->0 £ B(E * a) then B(E * a * (3) = B(E * (3) 

(CB) requires that, whenever B(E * a) is inconsistent with (3, revising E * a with (3 will 
completely ignore the revision by a. Its semantic counterpart is as follows: 

(CBR) For v, w £ [B(E * a)}, v ^e*« w iff v w 

As shown by Darwiche and Pearl (1997), natural revision minimises changes in conditional 
beliefs, with /3 \ a being a conditional belief of an epistemic state E iff (3 G B(E * a). In 
fact, Darwiche and Pearl show (Lemma 1, p. 7), that keeping and ^e*« as similar as 
possible has the effect of minimising the changes in conditional beliefs to a revision. So, 
from (CBR) it is clear that natural revision is an application of minimal change to epistemic 
states. It requires that, barring the changes mandated by DP-AGM, the relative ordering of 
valuations remains unchanged, thus keeping z<e*« as similar as possible to ^e- In that sense 
then, natural revision is the most conservative of all DP-operators. Such a strict adherence 
to minimal change is inadvisable and needs to be tempered appropriately, an issue that will 
be addressed in Section 5. Darwiche and Pearl have shown that (CB) is too strong, and 
that natural revision is not all that natural, sometimes yielding counterintuitive results. 

Example 2 (Darwiche & Pearl, 1997) We encounter a strange animal and it appears to be 
a bird, so we believe it is one. As it comes closer, we see clearly that the animal is red, so 
we believe it is a red bird. To remove further doubts we call in a bird expert who examines 
it and concludes that it is not a bird, but some sort of animal. Should we still believe the 
animal is red? (CB) tells us we should no longer believe it is red. This can be seen by 
substituting B(E) = Cra(-i/3) = Cn(bird) and a = red in (CB), instructing us to totally 
ignore the observation a as if it had never taken place. 

Given Example 2, it is perhaps surprising that Darwiche and Pearl never considered postu- 
late (P) below. In this example, the argument for retaining the belief that the creature is 
red hinges upon the assumption that being red is not in conflict with the newly obtained 
information that it is a kind of animal. That is, because learning that the creature is an 
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animal will not automatically disqualify it from being red, it is reasonable to retain the 
belief that it is red. More generally then, whenever a is consistent with a revision by f3, it 
should be retained if an a-revision is inserted just before the /^-revision. 

(P) If (£ B(E * p) then a G B(E * a * /3) 

Applying (P) to Example 2 we see that, if red is consistent with B(E * -ibird), we have 
red G B(E * red * -ibird). Put differently, (P) requires that you retain your belief in the 
animal's redness, provided this would not have been precluded if the observation about it 
being red had never occurred. (P) was also proposed independently of the present paper 
by Jin and Thielscher (2005) where it is named Independence. The semantic counterpart of 
(P) looks like this: 

(PR) For v G [a] and w G [^a], if v w then v -<¥.*a w 

(PR) requires an a- world v that is at least as plausible as a -ia-world w to be strictly more 
plausible than w after an a-revision. The following result was also proved independently 
by Jin and Thielscher (2005). 

Proposition 2 If * satisfies DP-AGM, then it satisfies (P) iff it also satisfies (PR). 

Proof: For (P)=>(PR), let v G [a], w G [ ick] , v <e w, and let (3 be such that [f3] = {v,w}. 
This means that ->a ^ B(E * (3) (since [B(E * j3)] is either equal to {v} or to {v, w}), and so, 
by (P), a G B(E * a * j3). And therefore v ^e*q w, for if not, we would have that w ^e*« v, 
from which it follows that w G [B(E * a * /?)], and so a £ B(K * a* /3)]. 

For (P)<J=(PR), suppose that ->a £ B(E * 0). This means there is a v G [a] (1 [B(E * /?)]; 
that is, v w for every w G [0\. And this means that a G B(E * a * (3). For if not, it 
means there is an x in [-ia] PI [B(E * a * (S)\. Now, since x G [B(E * a * (3)], it follows from 
DP-AGM that x ^e*» w for every w G and so x ^e*q v (since v G [B(E * (3)] C [/3]). 
But it also follows from DP-AGM that x G [/3], and therefore that v ^e a;, and by (PR) it 
then follows that v -<^*a x; a contradiction. □ 

Rule (PR) enforces certain changes in the ordering ^e after receipt of a. In fact as soon 
as there exist an a-world v and a -ia-world w on the same plausibility level somewhere 
in ^e (hi that both v ^e w and w ^e v), (PR) implies ^E*a7^E- Furthermore these 
changes must also occur even when a is already believed in E to begin with, i.e., a G B(E). 
(Although of course if a G B(E) then B(E * a) = B(E), i.e., the knowledge base associated 
to E will remain unchanged - this follows from DP-AGM.) The rules (P)/(PR) ensure input 
a is believed with a certain minimal strength of belief - enough to help it survive the next 
revision. The point that being informed of a can lead to an increase in the strength of an 
agent's belief in a, even in cases where the agent already believes a to begin with, has been 
made before, e.g., by Friedman and Halpern (1999, p. 405). Note that (P) has the antecedent 
of (C4) and the consequent of (C3). In fact, (P) is stronger than (C3) and (C4) combined. 
This is easily seen from the semantic counterparts of these postulates. It also follows that 
the only concrete example of an iterated revision operator provided by Darwiche and Pearl, 
the operator they refer to as • and which employs a form of Spohnian conditioning (Spohn, 
1988), satisfies (PR), and therefore (P) as well. Furthermore, by adopting (P) we explicitly 
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exclude natural revision as a permissible operator. So accepting (P) is a move towards 
the viewpoint that information obtained before the latest input ought not to be discarded 
unnecessarily. 

Based on the analysis of this section we propose a strengthening of the Darwiche- Pearl 
framework in which (E*5) is replaced by (E*5') and (C3) and (C4) are replaced by (P). 

Definition 2 A revision operator is admissible iff it satisfies RAGM, (CI), (C2), and (P). 

Inasmuch as the Darwiche-Pearl framework can be visualised as one in which a-worlds 
slide "downwards" relative to —>a- worlds, admissible revision ensures, via (PR), that this 
"downwards" slide is a strict one. 

We now pave the way for the third postulate we would like to add in this paper to the 
Darwiche-Pearl framework. To begin with, note that another view of (P) is that it is a 
significant weakening of the following property, first introduced by Nayak et al. (1996): 

(Recalcitrance) If ->a £ Cn(/3) then a € B(E * a * /3) 

Semantically, (Recalcitrance) corresponds to the following property, as was pointed out by 
Booth (2005) and implicitly contained in the work of Nayak et al. (2003): 

(R) For v € [a], w € [- , oi\, v -<e*« w 

(Recalcitrance) is a property of the lexicographic revision operator, the second of the well- 
known DP-operators we consider, and one that is just as old as natural revision. It was 
first introduced by Nayak (1993) and has been studied most notably by Nayak et al. (1994, 
2003), although, as with natural revision, the idea actually dates back to Spohn (1988). In 
fact, lexicographic revision is characterised by DP-AGM (and also RAGM) together with 
(CI), (C2) and (Recalcitrance), a result that is easily proved from the semantic counterparts 
of these properties and Nayak et al. 's semantic characterisation of lexicographic revision in 
(2003). Informally, lexicographic revision takes the assumption of "most recent is best", 
on which the Success postulate (E * 2) is based, and adds to it the assumption of temporal 
coherence. In combination, this leads to the stronger assumption that "more recent is 
better" . 

An analysis of the semantic characterisation of lexicographic revision shows that it is 
the least conservative of the DP-operators, in the sense that it effects the most changes in 
the relative ordering of valuations permitted by DP-AGM (or RAGM for that matter) and 
the Darwiche-Pearl postulates. Since it is also an admissible revision operator, it follows 
that it is also the least conservative admissible operator. 

The problem with (Recalcitrance) is that the decision of whether to accept f3 after a 
subsequent revision by a is completely determined by the logical relationship between j3 
and a - the epistemic state E is robbed of all influence. The replacement of (Recalcitrance) 
by the weaker (P) already gives E more influence in the outcome. What we will do shortly 
is constrain matters further by giving E as much influence as allowed by the postulates for 
admissible revision. Such a move ensures greater sensitivity to the agent's epistemic record 
in making further changes. 

Note that lexicographic revision assumes that more recent information takes complete 
precedence over information obtained previously. Thus, when applied to Example 2, it 
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requires us to believe that the animal, previously assumed to be a bird, is indeed red, 
because zed is a recent input which does not conflict with the most recently obtained input. 
While this is a reasonable approach in many circumstances, a dogmatic adherence to it can 
be problematic, as the following example shows. 

Example 3 While holidaying in a wildlife park we observe a creature which is clearly red, 
but we are too far away to determine whether it is a bird or a land animal. So we adopt the 
knowledge base B(E) = Cn(red). Next to us is a person with knowledge of the local area 
who declares that, since the creature is red, it is a a bird. We have no reason to doubt him, 
and so we adopt the belief red — > bird. Now the creature moves closer and it becomes clear 
that it is not a bird. The question is, should we continue believing that it is red? Under 
the circumstances described above we want our initial observation to take precedence, and 
believe that the animal is red. But lexicographic revision does not allow us to do so. 

Other examples along similar lines speaking against a rigid acceptance of (Recalcitrance) 
are those of Glaister (1998, p.31) and Jin and Thielscher (2005, p.482). 

While (P) allows for the possibility of retaining the belief that the animal is red, it does 
not enforce this belief. The rest of this section is devoted to the discussion of a property 
which does so. To help us express this property, we introduce an extra piece of terminology 
and notation. 

Definition 3 a and P counteract with respect to an epistemic state E, written a ^>e P, 
iff -i/3 G B(E * q) and G B(E * j3). 

The use of the term counteract to describe this relation is taken from Nayak et al. (2003). 
a P means that, from the viewpoint of E, a and P tend to "exclude" each other. We 
will now discuss a few properties of this relation. First note that <~->e depends only on the 
total preorder obtained from E. Indeed we have a <~^e P iff both min(o, ^e) Q ["'P] an d 
min(/3, <e) Q [~^ a ]- This in turn can be reformulated in the following way, which provides 
a useful aid to visualise a counteracts relation: 

Proposition 3 a <~~>e P iff there exist v G [a], w G [P] such that both v -<e x and w -<e x 
for all x G min(o A /?, <e)- 

Proof: First note that, since obviously min(a, <e) Q [a], min(a, ^e) Q H/?] may be rewrit- 
ten as min(a, ^e) Q [- '(ct A P)\. Using the fact that <e is a total preorder, it is easy to see 
that this can hold iff there exists v G [a] such that v -<e x for all x G min(a A P, ^e)- In 
the same way we may rewrite min(/3, ^e) Q [^ a ] as min(/3, ^e) Q [~^(c* A P)], which is then 
equivalent to saying there exists w G [->/?] such that w ^e x for all x G min(a A P, ^e)- D 

In other words, Proposition 3 says a P iff there exist both an a-world and a /3-world 
which are strictly more plausible than the most plausible (a A /3)-worlds. Other immediate 
things to note about ^>e are that it is symmetric, and that it is syntax-independent, i.e., if 
a ^>e P and P = P' then a ^~>e P' ■ Furthermore if a and P are logically inconsistent with 
each other then a «~~>e P, but the converse need not hold (see the short example after the 
next proposition for confirmation). Thus 4~->e can be seen as a weak form of inconsistency. 
The next result gives two more properties of ^^e- 
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Proposition 4 Given RAGM, the following properties hold for <-~*e-' 

(i) If a ^~>e P and 7 P then (a V 7) ^>e P 

(ii) // a «A~>e P and 7 </~>e P then (a V 7) <A>e P 

Proof: (i) Suppose a «~->e P and 7 «~~>e To show (a V 7) «~->e P we need to show 
both -i/3 € £(E * (a V 7)) and ->(a V 7) G B{K * P). For the former we already have both 
€ 5(E * a) and -i/3 G i?(E * 7) from a ^~>e P and 7 ^>e /3 respectively. Since it follows 
from RAGM that B(E * A) n J5(E * x) Q B(E * (A V x)) for any A, x G L, we can conclude 
from this G -B(E * (a V 7)). For the latter we already have both —>a G B(E * P) and 
-17 G -B(E * /3) from a «~~>e /3 and 7 ^>e /? respectively. And from this we can conclude 
-•(a V 7) G 5(E * /3), again using RAGM (specifically (E * 1)). 

(ii) Suppose a <A>e P and 7 <A->e P- Firstly, if either G" B(E * /?) or -17 G" 5(E * /3) 
then we must have ->(a V 7) G" 2?(E * P) by RAGM and so (a V 7) <A>e /? as required. So 
suppose both -*a G B(E * /3) and -17 G 2?(E * P). Then, since a <A>e P and 7 «A>e /3, 
this means we have both —i/3 B(E * a) and -ifi G" B(E * 7). Since it follows from RAGM 
that B(E * (A V x)) Q B(E * A) U 5(E * x) for any A, x G L, it follows from these two that 
-1/9 G" 5(E * (a V 7)) and so also in this case (a V 7) «A~>e /3 as required. □ 

The first property above says that if P counteracts with two sentences separately, then it 
counteracts with their disjunction, while the second says that it cannot counteract with 
a disjunction without counteracting with at least one of the disjuncts. Obviously these 
properties also hold for the binary relation of logical inconsistency. However one departure 
from the inconsistency relation is that it is possible to have both 7 <A->e P and (0JV7) «~~>e P- 
To see this assume for the moment L is generated by just three propositional atoms {p, q, r} 
and take a = p, P = q and 7 = r. Then take ^e to be such that its lowest plausibility 
level contains only the two valuations 010 and 100, and the next plausibility level only the 
valuation 111. 

We are now ready to introduce our third postulate. It is the following: 
(D) If a <r~> E (3 then ->a G B(E * a* P) 

(D) requires that, whenever a and P counteract with respect to E, a should be disallowed 
when an o-revision is followed by a /3-revision. That is, when the /3-revision of E * a takes 
place, the information encoded in E takes precedence over the information contained in 
E * a. Darwiche and Pearl (1997) considered this property (it is their rule (C6)) but argued 
against it, citing the following example. 

Example 4 (Darwiche & Pearl, 1997) We believe that exactly one of John and Mary com- 
mitted a murder. Now we get persuasive evidence indicating that John is the murderer. This 
is followed by persuasive information indicating that Mary is the murderer. Let a represent 
that John committed the murder and P that Mary committed the murder. Then (D) forces 
us to conclude that Mary, but not John, was involved in the murder. This, according to 
Darwiche and Pearl, is counterintuitive, since we should conclude that both were involved 
in committing the murder. 

Darwiche and Pearl's argument against (D) rests upon the assumption that more recent 
information ought to take precedence over information previously obtained. But as we have 
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seen in Example 3, this is not always a valid assumption. In fact, the application of (D) to 
Example 3, with a = red — > bird and /3 = -ibird, produces the intuitively correct result 
of a belief in the observed animal being red: red G B(E * (red — > bird) * -ibird). 

Another way to gain insight into the significance of (D) is to consider its semantic 
counterpart: 

(DR) For v G [— ick], w G [a], and w ^ [5(E * a)], if u -<e w then v ^e*q to 

(DR) curtails the rise in plausiblity of a-worlds after an a-revision. It ensures that, with 
the exception of the most plausible a-worlds, the relative ordering between an a-world and 
the -ia-worlds more plausible than it remains unchanged. 

Proposition 5 Whenever a revision operator * satisfies RAGM, then * satisfies (D) iff it 
satisfies (DR). 

Proof: For (D)=>(DR), suppose that v G [~'0t], w G [a], w £ [B(E * a)], v -<e w, and let 
P be such that [f3] = {v,w}. Then -.a G B(E * (3) and ->0 G B(E * a), and so, by (D). 
—>a G B (E * a * 0). From this it follows that v -<E*a w. For if not, we would have that 
w ^E*a v, which means that w G [B(¥, * a * f3)], and therefore that ->a £ B(E * a * (3); a 
contradiction. 

For (D)^(DR), suppose that G B(E * a) and that ->a G B(E * /3), but assume that 
->a B(E * a * f3). This means there is a w G [a] that is also in [B(E * a * (3)}. Now 
observe that w £ [B(E * (3)] since w is an a-model. Also, since w G [5(E * a * /?)], it 
follows from RAGM that w is a /3-model, and therefore w ^ [5(E * a)]. Our supposition of 
-iq G B(E * (3) means that min(/3, C [->«]. Since to G [a] fl it thus follows that there 
is a v G [/?] fl [-ia] such that v ^e w- By (DR) it then follows that v -<E*a w- But then w 
cannot be a model of B(E * a * /3); a contradiction. □ 



4. Restrained Revision 

We now strengthen the requirements on admissible revision (those operators satisfying 
RAGM, (CI), (C2) and (P)) by insisting that (D) is satisfied as well. To do so, let us 
first consider the semantic definition of an interesting admissible revision operator. Recall 
that RAGM fixes the set of (^E*a)-mhnmal models, setting them equal to min(a, -<e), but 
places no restriction on how the remaining valuations should be ordered. The following 
property provides a unique relative ordering of the remaining valuations. 



(RR) says that the relative ordering of the valuations that are not (^E*a)-minimal remains 
unchanged, except for a-worlds and -ia-worlds on the same plausibility level; those are split 
into two levels with the a-worlds more plausible than the -ia-worlds. So RAGM combined 
with (RR) fixes a unique ordering of valuations. 

Definition 4 The revision operator satisfying RAGM and (RR) is called restrained revi- 
sion. 



(RR) \/v,w i [B(E * a)], v ^ E «* w iff 



{ 



v -<e w or, 

v -<e w and (y G [a] or w G [^a]) 
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It turns out that within the framework provided by admissible revision, it is only restrained 
revision that satisfies (D). We prove this with the help of the following lemma, asserting 
the equivalence of (RR) to (CR1), (CR2), (PR) and (DR) in the presence of RAGM. 

Lemma 1 Whenever a revision operator * satisfies RAGM, then * satisfies (RR) iff it 
satisfies (CR1), (CR2), (PR), and (DR). 

Proof: For (CR1)<J=(RR), pick v,w G [a]. If v G [B(E * a)] then (CR1) follows from 
RAGM. If not, it follows from RAGM that w <£ [B(E * a)}, and then (CR1) follows from 
a direct application of (RR). For (CR2)^=(RR), pick v,w G [->a]. From RAGM it follows 
that v,w [B(E * a)], and then we obtain (CR2) from a direct application of (RR). 
Observe that (RR) can be rewritten as 



Now, for (PR)^(RR), pick v G [a] and w G ha]. If v G [B(E * a)] then (PR) follows 
from RAGM. If not, it follows from a direct application of (RR'). For (DR)<J=(RR), pick 
v G [->a], w G [a], and w ^ [B(E * a)]. Then (PR) follows from a direct application of 
(RR'). 

For (CR1), (CR2), (PR), (DR)=>(RR), let v,w £ [B(E*a)} and suppose that v ^ E *a w 
and v w (i.e. w v). We have to show that v :<e w and either v G [a] or w G [~~>ot]- 
Assume this is not the case. Then w ^e v or both v G [-■«] and w G [a]. Now, the second 
case is impossible because, together with w ^e v and (PR) it implies that w ^e*« v; a 
contradiction. But the first case is also impossible. To see why, observe that by (CR1) it 
implies that v and w cannot both be a-models, by (CR2) v and w cannot both be —>a- 
models, by (DR) it cannot be the case that w G [->a] and v G [a]. And by (PR) it cannot 
be the case that w G [a] and v G [~<a]. This concludes the first part of the proof of (CR1), 
(CR2), (PR), (DR)=>(RR). For the second part, let v,w (£ [B(E*a)\ and suppose first that 
v ^e w- If v,w G [a] then v ^e*« w follows from (CR1). If v,w G [->a] then v ^E*a w 
follows from (CR2). If v G [a] and w G [-ice] then v ^e*« w follows from (PR). If v G [— >ck] 
and w G [a] then f ^e*« w follows from (DR) . Now suppose that v ^e w and either f G [a] 
or u; G [-ia]- If f G [a] then w ^e*« ^ follows either from (CR1) or (PR), depending on 
whether w G [a] or w G ["■a]. And similarly, if iw G [->a] then v ^e*« ^ follows either from 
(CR2) or (PR), depending on whether v G [-ia] or f G [a]. □ 

Theorem 2 RAGM, (CI), (C2), (P) and (D) provide an exact characterisation of re- 
strained revision. 

Proof: The proof follows from Lemma 1, Proposition 2, Proposition 5, and the correspon- 
dence between (CI) and (CR1), and (C2) and (CR2). □ 

Another interpretation of (RR) is that it maintains the relative ordering of the valuations 
that are not (^E*a)- m i mma b except for the changes mandated by (PR). From this it can 
be seen that restrained revision is the most conservative of all admissible revision operators, 
in the sense that effects the least changes in the relative ordering of valuations permitted 



(RR') Vv,w i [B(E *a)],v -< E «* w iff 



{ 



v ^e w and, 

v ^e w or (y G [a] and w G [->«]) 



139 



Booth & Meyer 



by admissible revision. So, in the context of admissible revision, restrained revision takes 
on the role played by natural revision in the Darwiche-Pearl framework. 

In the rest of this section we examine some further properties of restrained revision. 
Firstly, Examples 3 and 4 share some interesting structural properties. In both, the initial 
knowledge base 5(E) is pairwise consistent with each of the subsequent sentences in the 
revision sequence, while the sentences in each revision sequence are pairwise inconsistent. 
And in both examples the information contained in the initial knowledge base 5(E) is 
retained after the revision sequence. These commonalities are instances of an important 
general result. Let T denote the non-empty sequence of inputs 71, . . . , 7„, and let E * T 
denote the revision sequence E * 71 * . . . * 7„. Furthermore we shall refer to an epistemic 
state E as T- compatible provided that -17$ ^ B(E) for every i in {1, . . . , n}. 

(O) If E is T-compatible then 5(E) C B(E * F) 

(O) says that as long as 5(E) is not in direct conflict with any of the inputs in the sequence 
71,..., 7„, the entire 5(E) has to be propagated to the knowledge base obtained from 
the revision sequence E * 71 * . . . * 7„. This is a preservation property that is satisfied by 
restrained revision. 

Proposition 6 Restrained revision satisfies (O). 

Proof: We denote by E * Tj, for i = 0, . . . , n, the revision sequence E * 71, . . . , 7* (with 
E * r = E). We give an inductive proof that, for Vt> € [5(E)] and [5(E)], v -<E*r\ w 

for i = 0, . . . , n. In other words, every 5(E)-world is always strictly below every non 5(E)- 
world. From this the result follows immediately. For i = this amounts to showing that 
v -<e w which follows immediately from the definition of and 5(E). Now pick any 
i = 1, . . . ,n and assume that v ^E*rVi w. We consider four cases. If v, w £ [7,] then it 
follows by (CR1) that v -<e*i\ w. If v, w € [ _, 7i] then it follows by (CR2) that v ^E*r\ w- 
If v € [7j] and w £ [^i] then it follows by (PR) that v -<E*ri w- And finally, suppose 
v € [->7i] and w £ [7^. By T^-compatibility there is an 1 G [B(E)] fl [7*], and by the 
inductive hypothesis, x ^e*]^-! w. So w ^ [5(E * Tj)], and then it follows by (DR) that 
v ^E*r\ w. □ 

Although restrained revision preserves information which has not been directly contradicted, 
it is not dogmatically wedded to older information. If neither of two successive, but incom- 
patible, epistemic states are in conflict with any of the inputs of a sequence V = 71, . . . , 7„, 
it prefers the latter epistemic state when revising by V. 

Proposition 7 Restrained revision satisfies the following property: 

(Q) IfE andE*a are both T-compatible but 5(E)U5(E*a) t= _L, then 5(E*a) C 5(E*a*r) 
and 5(E) g B(E*a*T) 

Proof: It follows immediately from Proposition 6 that 5(E * a) C 5(E * a * T). And 
5(E) ^ 5(E * a * T) then follows from the consistency of 5 (E * a * T). □ 

Next we consider another preservation property, but this time, unlike the case for (O) and 
(Q), we look at circumstances where 5(E) is incompatible with some of the inputs in a 
revision sequence. 
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(S) If -ip G B(E * a) and ->0 G B(E * ->a) then B(E *a*^a*p) = B(E * a * p) 

Note that, given RAGM, the antecedent of (S) implies that -i/3 G B(E). Thus (S) states 
that if -1/9 is believed initially, and that a subsequent commitment to either a or its negation 
would not change this fact, then after the sequence of inputs in which f3 is preceded by a and 
-•a, the second input concerning a is nullified, and the older input regarding a is retained. 

Proposition 8 Restrained revision satisfies (S). 

Proof: Suppose the antecedent holds. If ->a ^^E*a P then the consequent holds. In fact 
this can be seen from the property (T) in Proposition 10 below. So suppose ->a «A^e*o ft- 
Then either a B(E * a * (3) or —i/3 B(E * a * -ia). This latter doesn't hold by one of 
the assumptions together with (C2), so the former must hold. This implies —>a G B(E * f3) 
by (P). Combining this with the other assumption we get a <~~>e P- In this case we get 
J3(E * a * (3) = B(E * (3) (again using (T)), while (since ->a <A>e*q P) B(E * a * ->a * P) = 
B(E* a* (-iq A fi)) ((T) once more), which in turn equals B(E * (-<a A /?)) by (C2). Since 
->a G B(E * (5) this is in turn equal to B(E * fi) by RAGM as required. □ 

We now provide a more compact syntactic representation of restrained revision. First we 
show that (CI) and (P) can be combined into a single property, and so can (C2) and (D). 

Proposition 9 Given RAGM, 

1. (CI) and (P) are together equivalent to the single rule 
(C1P) // g" B(E * p) then B(E * a *p) = B(E * (a A p)) 

2. (C2) and (D) are together equivalent to the single rule 

(C2D) // a ^ E P then B{E * a * p) = B{E * p) . 

Proof: For (C1),(P)^(C1P), suppose <£ B(E*P). By (P) it follows that a G B(E*a*P) 
which means, by RAGM, that B(E * a * P) = B(E * a * (a A /?)). By (CI) it follows that 
B(E*a*(aAp)) = B(E*(aAp)), and thus that B{E*a*p) = B{E*(a/\p)). For (Cl)^(ClP), 
suppose that P t= a. Then g" B(E * p) by RAGM, and so B(E *a*P) = B(E * (a A p)) 
by (C1P). But since P = a A p it follows that B(E * a * p) = B(E * p). For (P)<=(C1P), 
suppose that B(E * p). Then B(E * a * /3) = B(E * (a A /?)) by (C1P) which means, 
by RAGM, that a G B(E *a*P). 

For (C2),(D)=KC2D), suppose that a ^ E P- By (D), G 5(E * a * P). By 
RAGM this means that B(E * a * P) = B(E * a * (-.a A /3)). Now, by (C2) it follows 
that B(E * a * (~>a A /?)) = B(E * (^a A p)). So B(E * a * p) = B(E * (-.a A /?)). But since 
—>a G -B(E*/3), we get by RAGM that £(E* (^a A/3)) = B(E*P), from which it follows that 
B(E * a *P) = B(E * P). For (C2)<*=(C2D), suppose that p \= ^a. Then a > E p for any E 
and by B(E * a * p) = B(E * p) by (C2D). For (D)^(C2D), suppose that a <~~> E p. Then 
B{E*a*p) = B(E*P) by (C2D) and since G B(E*P), it follows that G B(E*a*p). □ 

Both (C1P) and (C2D) provide conditions for the reduction of the two-step revision sequence 
E * a * P to a single-step revision (if only as regards the resulting knowledge base). (C1P) 
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reduces it to an (a A /3)-revision when a is consistent with a /3-revision. (C2D) reduces it 
to a /3-revision, ignoring a completely, when a and j3 counteract with respect to E. Now, 
it follows from RAGM that the consequent of (C1P) also obtains when -*(3 B(E * a). 
Putting this together we get a most succinct characterisation of restrained revision. 

Proposition 10 Only restrained revision satisfies RAGM and: 



Proof: From Theorem 2 and Proposition 9 it is sufficient to show that RAGM, (C1P) and 
(C2D) hold iff RAGM and (T) hold. So, suppose that * satisfies RAGM and (T). (C1P) 
follows from the bottom part of (T), while (C2D) follows from the top part. Conversely, 
suppose that * satisfies RAGM, (C1P) and (C2D). If a <-^ E P it follows from (C2D) that 
B(E * a * 0) = B(E * 0). If not, we consider two cases. If ->a £ B(E * 0) it follows from 
(C1P) that B(E*a*(3) = B(E*(aA/3)). Otherwise it has to be the case that ->p £ B(E*a). 
But then it follows from RAGM that B(E * a * 0) = B(E * (a A 0)). □ 

If we were to replace "a <~^e P" m the first clause in (T) by the stronger "a and j3 
are logically inconsistent", we would obtain instead the characterisation of lexicographic 
revision given by Nayak et al. (2003). 

Proposition 10 allows us to see clearly another significant property of restrained revision. 
For if a <~^e P then we know —>a € B(E * a * (3) directly from (D), while if a </^e P then 
Proposition 10 tells us B(E * a * P) = B(E * (a A /?)) and so a G B(E * a * p) by RAGM. 
Thus we see in the state IE * a * P the epistemic status of a (either accepted or rejected) is 
always completely determined, i.e., we have proved: 

Proposition 11 Restrained revision satisfies the following property: 

(U) // £ B(E *a*P) then a G B(E *a*P) 

(Given its similar characterisation just mentioned above, it is easy to see lexicographic 
revision satisfies (U) too.) Like (P), property (U) can be read as providing conditions 
under which the penultimate revision input a should be believed. Its antecedent is simply 
saying B(E*a*P) is consistent with a. Thus (U) is saying the penultimate input should be 
believed as long as it is consistent to do so. By chaining (U) together with (C4), we easily 
see that (U) actually implies (P) in the presence of (C4). As a consequence, we obtain the 
following alternative axiomatic characterisation of restrained revision. 

Theorem 3 RAGM, (CI), (C2), (C4), (U) and (D) provide an exact characterisation of 
restrained revision. 

For (U) , we are also able to provide a simple semantic counterpart property. It corresponds 
to a separating of all the a- worlds from all the -*a- worlds in the total preorder ^e*« following 
an a-revision, in that each plausibility level in ^e*« either contains only a- worlds or contains 
only -i a- worlds: 

Proposition 12 Whenever a revision operator * satisfies RAGM, then * satisfies (U) iff 
it satisfies the following property: 
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(UR) For v G [a] and w G [-'(*], either v -<w,*a w or w ^e*<* v 

Proof: For (U)=>(UR) suppose (UR) doesn't hold, i.e., there exist a, v G [a] and w G [->a] 
such that both v ^e*« w and 10 ^E*a v. Letting (3 be such that \J3] = {v, w} we get 
[B(E * a * P)] = {v,w} from RAGM and thus both ->a, a G" B(E * a * P) (because of 
v,w G [B(E * a * /3)] respectively). Hence (U) doesn't hold. 

For (U)<^=(UR) suppose (U) doesn't hold, i.e., there exist a, (3 such that both -<a,a $ 
B(E * a * (3). Then there exist v G [a] and w G [~>oi\ such that v,w G [B(E * a * /?)] = 
(by RAGM) min(/3, ^ E * Q ). Since both d and w are (^E*a)-niinimal /3- worlds we must have 
both v ^e*« w and it) ^e*« v. Hence a,v,w give a counterexample to (UR). □ 

Finally in this section we turn to two properties first mentioned (as far as we know) by 
Schlecta et al. (1996) (see also the work of Lehmann et al. (2001)): 

(Disjl) B(E *a*/3)n B(E * 7 * /5) C B(E * (a V 7) * (3) 

(Disj2) B(E * (a V 7) * (3) C B(E * a * [3) U B(E * 7 * /5) 

(Disjl) says that if a sentence is believed after any one of two sequences of revisions that 
differ only at step i (step i being a in one case and 7 in the other), then the sentence 
should also be believed after that sequence which differs from both only in that step i is 
a revision by the disjunction a V 7. Similarly, (Disj2) says that every sentence believed 
after an (a V 7)-/3-revision should be believed after at least one of (a-f3) and (7-/?). Both 
conditions are reasonable properties to expect of revision operators. 

Proposition 13 Restrained revision satisfies (Disjl) and (Disj2). 

To prove this result we will make use of the properties of the counteracts relation given 
in Proposition 4, along with the following lemma. 

Lemma 4 If a ^ E (3 and (a V 7) ^ E P then B(E * ((a V 7) A P)) = B(E * (7 A /?)) 

Proof: Suppose a <~^e P and (a V 7) <A>e P- We will first show that this implies 
-■a G 5(E*((aV7)A/S)). We will then be able to conclude the required i?(E*((aV7) A/3)) = 
B (E * (7 A P)) using RAGM. So suppose on the contrary ->a £ B(E * ((a V 7) A P)). Then 
there exists some a-world w G min((a V 7) A P, ^e)- Then also w G min(a A P, -<e)- Since 
a «~^e P we know from Proposition 3 there exist an a-world w\ and a /3-world W2 such 
that Wi -<e w for i = 1, 2. Clearly w\ is also a (a V 7)-world, so we infer (a V 7) ^e P ~ 
contradiction. Hence ->a G B(E * ((a V 7) A P)) as required. □ 

Proof: [of Proposition 13] We prove both properties simultaneously by looking at two cases: 
Case (i): (a V 7) <-~>e P- In this case B(E * (a V 7) * P) = B(E * P) by property (T) in 
Proposition 10. Meanwhile we know from Proposition A(ii) that either a *^>e P or 7 <~~>e P, 
and so using (T) again we know at least one of B(E * a * P) and B(E * 7 * p) must also be 
equal to B(E * P). Hence we see both (Disjl) and (Disj2) hold in this case. 
Case (ii): (a V 7) y^> E P- In this case (T) tells us B(E * (a V7) * P) = B(E * ((a V7) A/5)) = 
S(E * ({a A P) V (7 A /?)). Meanwhile Proposition A(i) tells us at least one of a «A>e /3 
and 7 <A>e /? holds. We now consider two subcases according to which either both these 
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hold, or only one holds. If both these hold then B(E * a * (3) = B(E * (a A /?)) and 
B(E * 7 * /3) = B(E * (7 A /?)), so (Disjl) and (Disj2) reduce to 

(Disjl') B(E * (a A /?)) n B(E * (7 A /?)) C B(E * ((a A /3) V (7 A /?))) 

(Disj2') 5(E * ((a A /?) V (7 A /3))) C B(E * (a A /3)) U B(E * (7 A /?)) 

respectively. Now it is a consequence of RAGM that for any sentences 6, (ft we have both 
(1) B(E * B) n B(E * 0) C B(E * (6 V 0)) and (2) B(E * (0 V eft)) C B(E * 0) U B(E * </>)• 
Substituting a A /3 for 6 and 7 A /? for (ft here gives us the required (Disjl') (from (1)) and 
(Disj2') (from (2)). 

Now let's consider the subcase where a P and 7 y~>E P- (A symmetric argument 
will work for the other subcase a <A>e P an d 7 Then from 7 <A^e /5 we get 

B(E * 7 * /3) = B(E * (7 A /?)), while from a ^^e P together with (a V 7) ^e P we get also 
B(E*(aVj)*P) = B(E*(jA/3)) using Lemma 4. So in this case J B(E*(aV7)*/3) = £(E*7*/3), 
from which both (Disjl) and (Disj2) follow immediately. □ 

We end this section by remarking that it can be shown that lexicographic revision also 
satisfies (Disjl) and (Disj2). 

5. Restrained Revision as a Composite Operator 

As we saw in Section 3, Boutilier's natural revision operator - let us denote it in this section 
by © - is vulnerable to damaging counterexamples such as the red bird Example 2, and 
fails to satisfy the very reasonable postulate (P). Although a new input a is accepted in the 
very next epistemic state E © a, © does not in any way provide for the preservation of a 
after subsequent revisions. As Hans Rott (2003, p. 128) describes it, "[t]he most recent input 
sentence is always embraced without reservation, the last but one input sentence, however, 
is treated with utter disrespect". Thus, there seem to be convincing reasons to reject © as a 
viable operator for performing iterated revision. However, the literature on epistemic state 
change constantly reminds us that keeping changes minimal should be a major concern, and 
when judged from a purely minimal change viewpoint, it is clear that © can't be beaten! 
How can we find our way out of this apparent quandary? In this section we show that the 
use of © can be retained, provided its application is preceded by an intermediate operation 
in which, rather than revising E by new input a, essentially a is revised by E. 

Given an epistemic state E and sentence a, let us denote by E < a the result of this 
intermediate operation. E <i a is an epistemic state. The idea is that when forming E < a, 
the information in E should be maintained. That is, the total preorder ^E<a should satisfy 

v ^e w implies v ^E<a w. (1) 

But rather than leaving behind a entirely in favour of E, as much of the informational 
content of a should be preserved in E o a as possible. This is formalised by saying that for 
any v G [a],w G [->a], we should take v ^E<a w as long as this does not conflict with (1) 
above. It is this second requirement which will guarantee a enough of a "presence" in the 
revised epistemic state E * a to help it survive subsequent revisions and allow (P) to be 
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captured. Taken together, the above two requirements are enough to specify ^e<« uniquely: 



Thus, ^E<ja is just the lexicographic refinement of by the "two-level" total preorder < a 
defined by v -< a w iff v € [a] or w € [—>ot]- This "backwards revision" operator is not new. 
It has been studied by Papini (2001). It can also be viewed as just a "backwards" version 
of Nayak's lexicographic revision operator. We do not necessarily have a £ B(E < a) (this 
will hold only if -<a ^ B(E)), and so < does not satisfy RAGM. 

Given <, we can define the composite revision operator *< by setting 



This is reminiscent of the Levi Identity (Gardenfors, 1988), used in AGM theory as a recipe 
for reducing the operation of revision on knowledge bases to a composite operation consisting 
of contraction plus expansion. In (3), © is playing the role of expansion. The operator *<, 
does satisfy RAGM. In fact, as can easily be seen by comparing (2) above with condition 
(RR) at the start of Section 4, *<, coincides with restrained revision. 

Proposition 14 Let * R denote the restrained revision operator. Then * R = *<,. 

Thus we have proved that restrained revision can be viewed as a combination of two existing 
operators. 

6. How to Choose a Revision Operator 

The contribution of this paper so far can be summarised as follows. We have argued for 
the replacement of the Darwiche-Pearl framework by the class of admissible revision oper- 
ators, arguing that the former needs to be strengthened. In doing so we have eliminated 
natural revision, but retained lexicographic revision and the • operator of Darwiche and 
Pearl as admissible operators. We have also introduced a new admissible revision operator, 
restrained revision, and argued for its plausibility. But this is not an argument that re- 
strained revision is somehow unique, or more preferred than other revision operators. The 
contention is merely that, for epistemic state revision, the Darwiche-Pearl framework is 
too weak and should be replaced by admissible revision. And restrained revision, being an 
admissible revision operator, is therefore only one of many revision operators deemed to be 
rational. The question of which admissible revision operator to use in a particular situation 
is one which depends on a number of issues, such as context, the strength with which certain 
beliefs are held, the source of the information, and so on. This point has essentially also 
been made by Friedman and Halpern (1999). For example, Example 3 formed part of an 
argument for the use of restrained revision, and against the use of lexicographic revision. 
In effect we used the example to argue that red ought to be in B(K * red — > bird * -ibird), 
where B(E) = Cn(red). But if we change the context slightly, it becomes an example in 
favour of the use of lexicographic revision, and against restrained revision. 

Example 5 We observe a creature which seems to be red, but we are too far away to 
determine whether it is a bird or a land animal. So we adopt the knowledge base B(K) = 





E *< a = (E < a) © a 



(3) 



145 



Booth & Meyer 



Cn(red). Next to us is an expert on birds who remarks that, if the creature is indeed red, it 
must be a bird. So we adopt the belief red — > bird. Then we get information from someone 
standing closer to the creature that it is not a bird. Given this context, that is, the reliability 
of the expert combined with the statement that the creature initially seemed to be red, it is 
reasonable to adopt the lexicographic approach of "more recent is best" and conclude that 
the bird is not red. Formally, -ired € B(¥, * red — > bird * -ibird), where B(K) = Cn(red). 

For a case where the source of the information dramatically affects the outcome, consider 
the following example. 

Example 6 Consider the sequence of inputs where p is followed by a finite number, say n, 
of instances of the pair p —> q,^q. (To make this more concrete, the reader might wish to 
substitute p with red and q with bird.) Since p is not in direct conflict with any sentences in 
the sequence succeeding it, any revision operator satisfying the property O ( and this includes 
restrained revision) will require that p be contained in the knowledge base obtained from this 
revision sequence. Now, if each pair p — >■ q and ~^q is obtained from a different source, such 
a conclusion is clearly unreasonable. After all, such a sequence amounts to being told that 
p is the case, followed by n different sources essentially telling you that ->p is the case. On 
the other hand, if the pairs p — > q and -*q all come from the same source, the case is not so 
clear cut anymore. In fact, in this case one would expect the result to be the same as that 
obtained from the sequence p,p — >■ q, ->q, a sequence with the same formal structure as that 
employed in Example 3, where restrained revision was seen to be a reasonable approach. 

Another example in which restrained revision fares less well is the following: 4 

Example 7 Suppose we are teaching a class of students consisting of n boys and m girls, 
and suppose the class takes part in a mathematics competition. For each i = 1, . . . ,n and 
j = 1, . . . , m let the propositional variables pi and qj stand for "boy i won the competition" 
and "girl j won the competition" respectively, and suppose initially we believe one of the 
boys won the competition, i.e., B(K) = Cn((f) A S) where (j) = VjP« an d ^ * s 3 US ^ some 
sentence expressing the uniqueness of the competition winner. Now suppose we interview 
each of the boys one after the other, and each of them tells us that either one of the girls 
or he himself won, i.e., we obtain the sequence of inputs (-x^V pi)%. Suppose we are willing 
to accept the boys' testimony. Using a revision operator which satisfies O will lead us to 
believe boy n won the competition, which seems implausible. Lexicographic revision gives 
the desired result that one of the girls won the competition. 

From these examples it is clear that an agent need not, and in most cases, ought not 
to stick to the same revision operator every time that it has to perform a revision. This 
means that the agent will keep on switching from one revision operator to another during the 
process of iterated revision. Of course, this leads to the question of how to choose among the 
available (admissible) revision operators at any particular point. A comprehensive answer 
to this question is beyond the scope of this paper, but we do provide some clues on how to 
address the problem. In brief, we contend that epistemic states have to be enriched, with a 
more detailed specification of their internal structure. Looking back at the history of belief 
revision, we can see that this is exactly how the field has progressed. In the initial papers, 

4. We are grateful to one of the anonymous referees for suggesting this example. 
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such as those on AGM revision, an epistemic state was taken to contain nothing more than 
a knowledge base. So, for example, basic AGM revision as characterised by the first six 
AGM postulates imposes no structure on epistemic states at all. We shall refer to these as 
simple epistemic states. With full AGM belief revision as characterised by all eight AGM 
postulates, the view is still one of the revision of knowledge bases, but now every revision 
operator for knowledge base B is uniquely associated with a i?-faithful total preorder; i.e., 
a total preorder on valuations with the models of B as its minimal elements. From here 
it is a small step to define epistemic states to include such an ordering, i.e. to include the 
total preorder associated with an epistemic state E as part of the definition of E. We 
shall refer to these as complex epistemic states. 

This leads to two different views of the same revision process. If we view revision 
as an operator on simple epistemic states we have many different revision operators; one 
corresponding to each of the 5-faithful total preorders, but with no way to distinguish 
between them when having to choose a revision operator. Viewed as such, iterated revision 
is a process in which a (possibly) different revision operator is employed at every revision 
step. This is the principal view adopted by Nayak et al. (2003). However, if we view 
revision as an operator on complex epistemic states, every epistemic state contains enough 
information to determine uniquely the knowledge base, but not the faithful total preorder, 
resulting from the revision. In other words, we now have enough information encoded in 
an epistemic state to uniquely determine the knowledge base resulting from a revision, but 
we lack the information to uniquely determine the full epistemic state. The Darwiche- 
Pearl framework, and now also admissible revision, place some constraints on the resulting 
epistemic state, but do not impose any additional structure on the complex epistemic state. 
In our view admissible revision for complex epistemic states is analogous to basic AGM 
revision for simple epistemic states. The next step would thus be to impose additional 
structure on complex epistemic states. This could possibly involve the addition of a second 
ordering on valuations as was done, for example, by Booth et al. (2004). In the case of 
simple epistemic states the effect of adding the two supplementary postulates is to constrain 
basic revision to the extent that each revision operator can be uniquely associated with a B- 
faithful total preorder. In that sense, the addition of the supplementary postulates allowed 
for the imposition of additional structure on simple epistemic states. Recall that one way of 
interpreting the two supplementary postulates is that they explain the interaction between 
revision by two sentences and revision by their conjunction, something the basic postulates 
do not address. 

So, as we have seen, the addition of the supplementary postulates leads to the definition 
of revision as operators on complex epistemic states. We conjecture that giving additional 
structure to complex epistemic states might involve the provision of postulates analogous to 
the two AGM supplementary postulates. In particular, we conjecture that such postulates 
might be such that they explain the interaction between two sentences and their conjunction, 
or disjunction, for iterated revision. Observe that none of the Darwiche-Pearl postulates, 
or the additional postulates for admissible revision for that matter, address this issue. In 
fact the only postulates to have been suggested (of which we are aware) which so far do 
address it are (Disjl) and (Disj2). We speculate that the appropriate set of supplementary 
postulates for iterated revision (which may or may not include the two just mentioned) will 
lead to the definition of extra structure on complex epistemic states, which can then be 
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incorporated into an enriched version of complex epistemic states, with revision then being 
seen as operators on these enriched entities. Let us refer to them as enriched epistemic 
states. Enriched epistemic states will enable us to determine uniquely the complex epistemic 
state resulting from a revision, thereby solving the question we started off with; that of 
determining which revision on complex epistemic states to use at every particular point 
during a process of iterated revision. Below we shall briefly discuss a possible way of 
enriching complex epistemic states. But note also that a recent proposal for doing so is 
that of Booth et al. (2006). It is instructive to observe that (Disjl) and (Disj2) both hold 
in their framework. 

The proposed outline above is not without its pitfalls. The most obvious problem with 
such an approach is that it leaves us with a meta-version of the dilemma that we started off 
with. Using enriched epistemic states we are now able to uniquely determine the complex 
epistemic states resulting from a revision, but not the resulting enriched epistemic state. We 
can lessen the problem by constraining the permissible resulting enriched epistemic states in 
the same way that admissible revision constrains the permissible complex epistemic states, 
but chances are that this whittling down will not produce a single permissible enriched 
epistemic state. And, of course, this is bound to occur over and over again. That is, 
whenever we solve the problem of uniquely determining an epistemic state with a certain 
structure by a process of further enrichment, we will be saddled with the question of how 
to uniquely determine the further enriched epistemic state resulting from a revision. Our 
conjecture is that at some level a point will be reached where constraining further enriched 
epistemic states, d la admissible revision, will eventually lead to a unique further enriched 
epistemic state associated with every revision. Only further research will determine whether 
our conjecture holds water. 

In conclusion, we have shown that the Darwiche-Pearl arguments lead to the acceptance 
of the admissible revision operators as a class worthy of study. The restrained revision 
operator, in particular, exhibits quite desirable properties. Besides taking the place of 
natural revision as the operator adhering most closely to the principle of minimal change, 
its satisfaction of the properties (O), (Q) and (U) shows that it does not unnecessarily 
remove previously obtained information. 

For future work we would also like to explore more thoroughly the class of admissible 
revision operators. In this paper we saw that restrained revision and lexicographic revision 
lie at opposite ends of the spectrum of admissible operators. They represent respectively 
the most conservative and the least conservative admissible operators in the sense that 
they effect the most changes and the least changes, respectively, in the relative ordering 
of valuations permitted by admissible revision. A natural question is whether there exists 
an axiomatisable class of admissible operators which represents the "middle ground" . One 
clue for finding such a class can be found in the counteracts relation 4~~>e which can be 
derived from an epistemic state E. As we said, this relation depends only on the preorder 

associated to E. In fact, given any total preorder ■< over V we can define the relation 
*w-»^. by 

a (3 iff min(a, ■<) C [-./?] and min(/3, ■<) C [->a]. 

Then clearly <~ v ~>e=^M e - Furthermore if ^ is the full relation V x V then 4~~>^ reduces to 
logical inconsistency. A counteracts relation stronger than ^>e 5 but still weaker than logical 
inconsistency can be found by setting ^>=^~>^, , where <' lies somewhere in between ^e 
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and V x V. Hence one avenue worth exploring might be to assume that from each epistemic 
state E we can extract not one but two preorders and ^ such that i^e^^e- Then, 
instead of only requiring a «~~>e P to deduce ->a G B(¥, * a * (3), as is done with restrained 
revision (the postulate (D)), we could require the stronger condition a ft for this 

to hold. We are currently experimenting with strategies for using the second preorder to 
guide the manipulation of ^e to enable this property to be satisfied. The use of a second 
preorder can be seen as a way of enriching the epistemic state, and might thus contribute 
to the solution of the choice of revision operators discussed in Section 6. 

Some more future work relates also to the two extreme cases revision, but looked at 
from a different angle. As mentioned earlier, lexicographic revision is a formalisation of 
the "most recent is best" approach to revision taken to its logical extreme. This approach 
is exemplified by the (E*2) postulate, also known as Success, which requires a revision to 
be successful, in the sense that the epistemic input provided always has to be contained 
in the resulting knowledge base. Given that (E*2) is one of the postulates for admissible 
revision, this requirement carries over even to restrained revision, which is on the opposite 
end of the spectrum for admissible revision. But this means that the admissible revision 
operator which differs the most from lexicographic revision still adheres to the dictum of 
"most recent is best", which raises the question of why the most recent input is given 
such prominence. The relaxation of this requirement would imply giving up (E*2) and 
venturing into the area known as non-prioritised revision (Booth, 2001; Chopra, Ghose, & 
Meyer, 2003; Hansson, 1999). We speculate that an appropriate relaxation of admissible 
revision, with (E*2) removed as a requirement, will lead to a class of (non-prioritised) 
revision operators strictly containing admissible revision, and with lexicographic revision 
still at one end of the spectrum, but with the other end of the spectrum occupied by the 
operator studied by Papini (2001) which was used as a sub-operation of restrained revision 
in Section 5. This operator is formalised by the extreme version of "most recent is worst"; 
in other words, "the older the better" . 
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